Using Rsyslog to send application logs to syslog server

Question

I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if it can also send logs of an application. I'm not sure if IncludeConfig directive works as it looks for another *.conf file.

Answer 1

rsyslog has support for reading from a file. This is done with the imfile module. You need the following config:

module(load="imfile" PollingInterval="10") #needs to be done just once

# needs to be done for each file you want to watch
input(type="imfile" File="/path/to/file1" 
     Tag="tag1" 
      StateFile="statefile1" 
      Severity="error" 
      Facility="local7")

There's more information at the rsyslog documentation site

Answer 2

You can always use the old syntax:

eg. /etc/rsyslog.d/11-your-file.conf

$ModLoad imfile

$InputFileName  /app/your-file.log 
$InputFileTag   your-tag
$InputFileStateFile     your-tag 
$InputFileSeverity      info
$InputFileFacility      local7 
$InputRunFileMonitor
$InputFilePersistStateInterval 1000 
local7.*  @@remote-rsyslog-server:port

Answer 3

If you hook a startup script you can use can combine

tail -n 0 -F /opt/appname/logs/file | logger ... 

The parameters for logger would be the priority and you could specify the remote syslog server or just use local setup and have rsyslog do the forwarding for you.

A con for this setup is that you must make sure you're tailing the log as your application starts or you'd miss records in between.

A better solution, but gives more work, would be to use something like logstash.

You configure the inputs according to your application logs, for file you can use sincedb to have it continue from where it last stopped and you have a module to output to syslog.

Depending on what you want this might be too much work.